# Decode\_xml fails on UTF-16 formatted input

**URL:** <https://discuss.elastic.co/t/decode-xml-fails-on-utf-16-formatted-input/295996>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 1, 2022, 8:17pm UTC](https://discuss.elastic.co/t/decode-xml-fails-on-utf-16-formatted-input/295996 "2022-02-01T20:17:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mesposito](https://avatars.discourse-cdn.com/v4/letter/m/9de0a6/32.png) [@mesposito](https://discuss.elastic.co/u/mesposito)\
**Post date:** [February 1, 2022, 8:17pm UTC](https://discuss.elastic.co/t/decode-xml-fails-on-utf-16-formatted-input/295996/1 "2022-02-01T20:17:21Z")

</div>

Hi, I am facing an issue where `xml_decode` and `xml_decode_wineventlog` fail to parse input data when it is in UTF-16. The following errors are produced:

```auto
failed in decode_xml on the "winlog.event_data.TaskContent" field: error decoding XML field: xml: encoding "UTF-16" declared but Decoder.CharsetReader is nil

```

```auto
failed in decode_xml_wineventlog on the "winlog.event_data.TaskContent" field: error decoding XML field: xml: encoding "UTF-16" declared but Decoder.CharsetReader is nil

```

This is the processor config:

```auto
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - decode_xml_wineventlog:
      field: winlog.event_data.TaskContent
      target_field: ""

```

An example field which causes the error:

```auto
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2022-01-27T10:20:14.8230337</Date>
    <Author>mesposito</Author>
    <Description>says good morning</Description>
    <URI>\Good Morning</URI>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger>
      <StartBoundary>2022-01-27T10:22:35</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByDay>
        <DaysInterval>1</DaysInterval>
      </ScheduleByDay>
    </CalendarTrigger>
  </Triggers>
  ...

```

This field and data can be recreated by scheduling an event using the Windows Task Scheduler. It looks like this might be happening because `encoding/xml` throws an error if a CharsetReader is not defined before encountering a non-UTF-8 charset.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2022, 10:17pm UTC](https://discuss.elastic.co/t/decode-xml-fails-on-utf-16-formatted-input/295996/2 "2022-03-01T22:17:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.